Skip to content

WIP: make CCA finalize push resilient to non-fast-forward and local h…#19

Draft
belaltaher8 wants to merge 1 commit into
mainfrom
belaltaher8/cca-finalize-push-rebase-noverify
Draft

WIP: make CCA finalize push resilient to non-fast-forward and local h…#19
belaltaher8 wants to merge 1 commit into
mainfrom
belaltaher8/cca-finalize-push-rebase-noverify

Conversation

@belaltaher8

Copy link
Copy Markdown

…ooks

The Engine SDK finalize push (commitAndPush -> finalizeChanges) ran a bare "git push --set-upstream origin HEAD" with no rebase/retry and surfaced only Node's generic "Command failed" message, dropping git's rejection reason.

On follow-up CCA jobs the runner can check out a base behind the live branch tip, so the finalize push is rejected non-fast-forward and fails silently.

This change:

  • rebases the agent's commit onto origin/ and retries the push when a push is rejected non-fast-forward (fetch first / behind);
  • surfaces git's captured stdout/stderr so the real reason is logged instead of a bare "Command failed";
  • adds --no-verify to commit/push as defense-in-depth so automated CCA pushes are not blocked by the repository's local git hooks (matches the runtime error path, which already pushes with noVerify).

…ooks

The Engine SDK finalize push (commitAndPush -> finalizeChanges) ran a bare
"git push --set-upstream origin HEAD" with no rebase/retry and surfaced only
Node's generic "Command failed" message, dropping git's rejection reason.

On follow-up CCA jobs the runner can check out a base behind the live branch
tip, so the finalize push is rejected non-fast-forward and fails silently.

This change:
- rebases the agent's commit onto origin/<branch> and retries the push when a
  push is rejected non-fast-forward (fetch first / behind);
- surfaces git's captured stdout/stderr so the real reason is logged instead of
  a bare "Command failed";
- adds --no-verify to commit/push as defense-in-depth so automated CCA pushes
  are not blocked by the repository's local git hooks (matches the runtime
  error path, which already pushes with noVerify).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
GitHub Advanced Security started work on behalf of belaltaher8 June 26, 2026 18:01 View session
GitHub Advanced Security finished work on behalf of belaltaher8 June 26, 2026 18:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant